[Conch]

Bruteforce your enemy and recover the password.
By Conch.

Hey Hackforums.
So, I guess you want to crack hotmail accounts? Well I'm here to show you.
Fed up of downloading bruteforcing applications? Ones that don't work? Or you're scared they may be backdoored?

Let's use a tool that is legitimate for breaking the security on logins.
This tool is called Hydra.

You can download it from..
http://www.thc.org/thc-hydra/

Because I use GNU/Linux, this tutorial will be based on Ubuntu 12.04.
Don't worry if you use Windows, the commands are pretty much the same.

Open a terminal and type...

Code

sudo apt-get install hydra

If you prefer a GTK/GUI version.

Code

sudo apt-get install hydra-gtk

Only the command line/terminal version is covered in this tutorial.
I want you to use less of GUI's, we are using Linux after all :)

Let's go!
So.. if you type..

Code

hydra

You'll get a list of options to choose from,
We want to attack the SMTP - which is the mail server, for hotmail.
Because Hotmail runs on SSL connections, we need to specify the SSL port when attacking.

The full command looks like this..

Make sure you FIRST change to the wordlist directory, if you saved the 14 million pass to the Desktop..

Code

cd ~/Desktop

Code

hydra -V -S -l [email protected] -P "14 million pass.txt" -e ns -o "Cracked!" -t 8 pop3.live.com pop3 -s 995

These options mean...

hydra - We use the application name.

-V - This shows the output of passwords it checks, you can also add -Vv for extra verbosity [errors, warnings etc - Not really recommended, as it just floods the window]

-S - Use an SSL connection [Needed!]

-P The dictionary list we will use to attack the given Hotmail address [ I will post a link to a 14 million wordlist, perfect for cracking!]

-e ns - try "n" null password, "s" login as pass

-o "Cracked" - Once the password has been cracked, it will store it in a nice file called "Cracked" [Note your directory!]

-t 8 - The number of tasks to use, 8 is fine, any more could cause too many passwords checking and overload the times it gets to check each individual password.

Server - Service - pop3.live.com pop3 - We want to use Hotmail's pop3 server with the service pop3!

-s 995 - This is the SSL port [Needed!]

Upon hitting enter, it should start cracking!
If you get errors, like timeout errors, re-check your terminal command, an error isn't because the bruteforce doesn't work, it just means there is something wrong with the command (Unless Hotmail put a security lock on!)

Here is a picture of me Cracking!


Here is the 14 million wordlist.

Code

http://www.mediafire.com/?1whma3u7aev3985

If you want to resume the attack at a later day, use the command..

Code

hydra -R

Not using this command will overwrite the recovery file and start from the beginning.

Hope you guys like.
Please, if you share this, give me credits :)

Warm Regards,
Conch.

[Gardenhose]

Nice tut however hot mail has captchas which hydra doesnt get around. Thats why when you netstat -ano you see "SYN_SENT which means you are waiting for a response but arent getting it. I have yet to see a brute force that actually works with captchas. I belive you need one that uses different proxies which will jsut takes you soo much longer

[thevor]

hey, thanks! awesome tutorial! i found it to be very helpful.

[BuS.]

Nice tut however hot mail has captchas which hydra doesnt get around. Thats why when you netstat -ano you see "SYN_SENT which means you are waiting for a response but arent getting it. I have yet to see a brute force that actually works with captchas. I belive you need one that uses different proxies which will jsut takes you soo much longer

This doesn't use the website. It uses the pop3 server login.

[Gardenhose]

This doesn't use the website. It uses the pop3 server login.

Sorry can you please explain this more. Also am I the only one who cant find the download link on thc's page????

[Contri]

can someone maybe help me, ive got downloaded the hydra-7.3.tar.gz rar file and save on desktop. i have got win 7 and when i tipe sudo apt-get install hydra-gtk it says The command "sudo" is either misspelled or could not be found. what can i do to install it. thx in advance :)

[xDARKFiRE]

can someone maybe help me, ive got downloaded the hydra-7.3.tar.gz rar file and save on desktop. i have got win 7 and when i tipe sudo apt-get install hydra-gtk it says The command "sudo" is either misspelled or could not be found. what can i do to install it. thx in advance :)

that's a linux command, hence why windows has no idea what it is

[dzrt]

I got this error:

bash: !": event not found

[Betelguese]

I have no idea how to download hydra. I have the link but i cant seem to get the program installed

[Syperus]

Download Cygwin and you will be able to install hydra on windows

[iBrandon3182]

hey, thanks! awesome tutorial! i found it to be very helpful.

[Betelguese]

Download Cygwin and you will be able to install hydra on windows

I did download cygwin but i still cant install it lol. Im a noob

[kwnocree]

It says me:
bash: !": event not found
:(

[Jesusisking]

Cut the scan time down by using the rockyou list, if it's not there then stop burning electricity

[Yugen]

Does anyone know why i am getting this error?
bash: !": event not found